#FactCheck- Viral video of burning ship falsely linked to US attack on vessel carrying Indian nationals in Oman waters

Executive Summary

‍
A video of former Chief of Defence Staff (CDS) General Anil Chauhan is going viral on social media. The video is being shared with the claim that, referring to the losses suffered by India during Operation Sindoor, he said, “Even if we lose four aircraft or 40 aircraft, India will still remain a larger economy. What matters is your ability to recover from the losses. Whatever losses we suffered, we can recover much faster than Pakistan.” A research done by the Research Wing of the CyberPeace examined the claims made in the video and compared them with General Anil Chauhan’s original remarks at the event.The research found that the viral video’s audio has been digitally manipulated. The alleged statement heard in the viral clip does not appear in the original footage.

‍

Claim:

A Pakistani user on social media platform X shared the viral video with the caption: “BREAKING: Former Indian Chief of Defence Staff revealed details about the losses suffered during Operation Sindoor, saying, ‘Whatever losses we suffered are not important. What matters is that we can recover quickly.’”

The link to the post and a screenshot are provided below.

https://x.com/InsiderWB/status/2092559622225940952 

‍

‍

Fact Check

‍

Upon closely examining the viral video, we noticed the ANI logo. We then conducted a reverse image search of keyframes from the viral clip. During the search, we found the original video published by ANI, in which General Chauhan discusses the relationship between political objectives and military strategy.

https://x.com/ANI/status/2092217553355743409 

‍

‍

He said, “Politics and war are inseparable.” He further explained that a nation’s political interests are paramount, while the armed forces are one of several instruments used to safeguard those interests. General Chauhan also discussed the role of military leadership in presenting various options to the political leadership, as well as the importance of peacetime preparedness and training. He also spoke about training, contingency planning, and the need to balance military risks with political objectives. Notably, the statement attributed to him in the viral video,“Whatever losses we suffered are not important. What matters is that we can recover quickly” — does not appear anywhere in the original video. Additionally, the audio used in the viral video was also analysed using Resemble AI. The tool’s analysis identified the audio as AI-generated, indicating that the audio in the viral clip had been manipulated.

‍

Conclusion

‍

The research found that General Chauhan’s voice in the viral video has been digitally manipulated. The alleged statement heard in the viral clip does not appear in the original video.

‍

Introduction

Data Breaches have taken over cyberspace as one of the rising issues, these data breaches result in personal data making its way toward cybercriminals who use this data for no good. As netizens, it's our digital responsibility to be cognizant of our data and the data of one's organization. The increase in internet and technology penetration has made people move to cyberspace at a rapid pace, however, awareness regarding the same needs to be inculcated to maximise the data safety of netizens. The recent AIIMS cyber breach has got many organisations worried about their cyber safety and security. According to the HIPPA Journal, 66% of healthcare organizations reported ransomware attacks on them. Data management and security is the prime aspect of clients all across the industry and is now growing into a concern for many. The data is primarily classified into three broad terms-

• Personal Identified Information (PII) - Any representation of information that permits the identity of an individual to whom the information applies to be reasonably inferred by either direct or indirect means.
• Non-Public Information (NPI) - The personal information of an individual that is not and should not be available to the public. This includes Social Security Numbers, bank information, other personal identifiable financial information, and certain transactions with financial institutions.
• Material Non-Public Information (MNPI) - Data relating to a company that has not been made public but could have an impact on its share price. It is against the law for holders of nonpublic material information to use the information to their advantage in trading stocks.

This classification of data allows the industry to manage and secure data effectively and efficiently and at the same time, this allows the user to understand the uses of their data and its intensity in case of breach of data. Organisations process data that is a combination of the above-mentioned classifications and hence in instances of data breach this becomes a critical aspect. Coming back to the AIIMS data breach, it is a known fact that AIIMS is also an educational and research institution. So, one might assume that the reason for any attack on AIIMS could be either to exfiltrate patient data or could be to obtain hands-on the R & D data including research-related intellectual properties. If we postulate the latter, we could also imagine that other educational institutes of higher learning such as IITs, IISc, ISI, IISERs, IIITs, NITs, and some of the significant state universities could also be targeted. In 2021, the Ministry of Home Affairs through the Ministry of Education sent a directive to IITs and many other institutes to take certain steps related to cyber security measures and to create SoPs to establish efficient data management practices. The following sectors are critical in terms of data protection-

• Health sector
• Financial sector
• Education sector
• Automobile sector

These sectors are generally targeted by bad actors and often data breach from these sectors result in cyber crimes as the data is soon made available on Darkweb. These institutions need to practice compliance like any other corporate house as the end user here is the netizen and his/her data is of utmost importance in terms of protection.Organisations in today's time need to be in coherence to the advancement in cyberspace to find out keen shortcomings and vulnerabilities they may face and subsequently create safeguards for the same. The AIIMS breach is an example to learn from so that we can protect other organisations from such cyber attacks. To showcase strong and impenetrable cyber security every organisation should be able to answer these questions-

• Do you have a centralized cyber asset inventory?
• Do you have human resources that are trained to model possible cyber threats and cyber risk assessment?
• Have you ever undertaken a business continuity and resilience study of your institutional digitalized business processes?
• Do you have a formal vulnerability management system that enumerates vulnerabilities in your cyber assets and a patch management system that patches freshly discovered vulnerabilities?
• Do you have a formal configuration assessment and management system that checks the configuration of all your cyber assets and security tools (firewalls, antivirus management, proxy services) regularly to ensure they are most securely configured?
• Do have a segmented network such that your most critical assets (servers, databases, HPC resources, etc.) are in a separate network that is access-controlled and only people with proper permission can access?
• Do you have a cyber security policy that spells out the policies regarding the usage of cyber assets, protection of cyber assets, monitoring of cyber assets, authentication and access control policies, and asset lifecycle management strategies?
• Do you have a business continuity and cyber crisis management plan in place which is regularly exercised like fire drills so that in cases of exigencies such plans can easily be followed, and all stakeholders are properly trained to do their part during such emergencies?
• Do you have multi-factor authentication for all users implemented?
• Do you have a supply chain security policy for applications that are supplied by vendors? Do you have a vendor access policy that disallows providing network access to vendors for configuration, updates, etc?
• Do you have regular penetration testing of the cyberinfrastructure of the organization with proper red-teaming?
• Do you have a bug-bounty program for students who could report vulnerabilities they discover in your cyber infrastructure and get rewarded?
• Do you have an endpoint security monitoring tool mandatory for all critical endpoints such as database servers, application servers, and other important cyber assets?
• Do have a continuous network monitoring and alert generation tool installed?
• Do you have a comprehensive cyber security strategy that is reflected in your cyber security policy document?
• Do you regularly receive cyber security incidents (including small, medium, or high severity incidents, network scanning, etc) updates from your cyber security team in order to ensure that top management is aware of the situation on the ground?
• Do you have regular cyber security skills training for your cyber security team and your IT/OT engineers and employees?
• Do your top management show adequate support, and hold the cyber security team accountable on a regular basis?
• Do you have a proper and vetted backup and restoration policy and practice?

If any organisation has definite answers to these questions, it is safe to say that they have strong cyber security, these questions should not be taken as a comparison but as a checklist by various organisations to be up to date in regard to the technical measures and policies related to cyber security. Having a strong cyber security posture does not drive the cyber security risk to zero but it helps to reduce the risk and improves the fighting chance. Further, if a proper risk assessment is regularly carried out and high-risk cyber assets are properly protected, then the damages resulting from cyber attacks can be contained to a large extent.

Introduction

‍

In the sprawling and ever-evolving landscape of cybercrime, phishing links, phoney emails, and dubious investment offers are no longer the only tools used by scammers. Cybercriminals are becoming skilled at taking advantage of commonplace digital behaviours, undermining confidence, and turning popular features of our most essential apps into weapons. A fast expanding international threat has been revealed by the National Cybercrime Threat Analytics Unit (NCTAU) of the Indian Cybercrime Coordination Centre(I4C)’s most recent advisory on “WhatsApp account renting”. This scam uses QR codes to trick users into connecting their WhatsApp accounts to fraudulent sites under the guise of a “quick income” opportunity. What initially appears innocuous turns into a tool for thieves to take control of accounts and use them for illicit purposes. 

‍

The Global Rise of Cyber Mule Networks

‍

Initially the word “mule” in cybercrime networks referred to a bank account used, knowingly often unknowingly, to transfer or “launder” money obtained from fraud and illegal activities. In light of the evolving nature of this cybercrime, Cyber mules in the present scenario can be referred to as, individuals who knowingly or unknowingly allow their digital identities, devices, or bank accounts to be used for illegal activity. 

Various cybersecurity companies as well as Europol and Interpol, have frequently cautioned that hackers are increasingly using digital mule recruiting, which frequently takes the form of the following:

• Work-from-home Offers
• Streams of passive income
• Monetisation of social media
• Roles for verification assistants 
• Apps that earn commissions

Earlier versions involved money transfers through personal bank accounts . Criminals now want your digital identity rather than just your money, as the trend has been reported to be changing. 

Scammers frequently “rent” victims’ Facebook, LINE, Telegram, and WeChat accounts in parts of Southeast Asia and Africa in order to conduct impersonation frauds or assist with criminal operations. The WhatsApp variant that is making its way to India is a logical progression, although it comes only with the widely used WhatsApp Web linked-device capability. 

‍

How the WhatsApp Account Renting Scam Works

‍

I4C’s advisory dated 15th October, 2025, highlights a sophisticated yet psychologically simple scheme that exploits trust, curiosity, and the illusion of easy income.The scam’s lifetime is as follows:

‍

‍1. The Hook: “Automatically Earn Passive Income”

Threat actors claim users can earn daily rewards by connecting their WhatsApp accounts to a new “partner platform” in their polished and professional Instagram and Facebook ads.

This strategy imitates international scam factories in Cambodia and Myanmar, where victims are lured into investment schemes or bogus tasks by social media advertisements.

‍‍

2.The Redirect: Rogue APKs & Fake Websites

When victims click on the advertisement, they are sent to

• Fake dashboards for earnings 
• Untrustworthy websites that imitate authentic financial interfaces
• Instructions for installing Android APKs from sources other than the Play Store
• These APKs often carry spyware or remote-access malware.

‍‍

3.The Trap: Scanning a QR Code

The user is asked to scan a QR code through WhatsApp’s “Linked Devices” feature, which is normally used for WhatsApp Web.

Without ever touching the victim’s phone, the con artist obtains complete session access to their WhatsApp account as soon as the QR is scanned.

Threat actors are able to:

• Transmit and receive messages
• Get access to contact lists 
• Participate in or start groups 
• Assume the victim’s identity
• Conduct frauds using their identities

‍

4.The Illusion: A Multi-Level Commission Structure

A pyramid-style earnings model is displayed to maintain credibility:

• 10% off direct invites
• 5% of secondary invites
• 2% of tertiary invitations

These figures are designed to encourage victims to recruit more users, increasing the number of compromised WhatsApp accounts.

‍‍

5.The Misuse: “Mule WhatsApp accounts”

The victim’s account becomes a digital mule once it is connected, allowing fraudsters to:

• Start UPI fraud and phishing
• Distribute harmful links
• Impersonate the victim to scam their contacts
• Participate in bulk messaging campaigns
• Get additional mule accounts

Precautions Issued by I4C

I4C has advised citizens to take the following precautions:

• You could face criminal charges or similar consequences if you carelessly rent or link your WhatsApp account for money
• Installing APKs from non-official app shops should be avoided
• Advertisements that promise automatic revenue, referral bonuses, or passive income should be avoided.
• Regularly check linked devices on WhatsApp: Settings → Linked Devices
• Use WhatsApp’s Official support page to report hacked accounts or impersonation: https://www.whatsapp.com/contact/forms/1534459096974129 
• Report financial fraud immediately by calling 1930 or visiting cybercrime.gov.in 

‍

CyberPeace Outlook

‍

The WhatsApp account rental fraud is not an isolated phenomenon; rather, it is the latest mutation of a global cybercrime apparatus that feeds on social engineering, digital identity theft, and international mule networks. Its simplicity, all it takes to take over your digital life is a QR code scan, makes it especially hazardous. I4C’s timely warning serves as an important reminder that easy money is nearly always a trap in the digital world and that, if we let our guard down, our most reliable platforms can become attack surfaces. Stay informed, and stay safe. In order to protect our identities, data, and communities, cyber hygiene is now a must.  

‍

References 

‍

• https://www.cnbctv18.com/personal-finance/mule-account-fraud-on-the-rise-what-it-is-and-how-to-shttps://i4c.mha.gov.in/theme/resources/advisories/Mule%20Whatsapp%20V1.4.pdftay-safe-19662507.htm 
• https://i4c.mha.gov.in/theme/resources/advisories/Mule%20Whatsapp%20V1.4.pdf 

‍